MacRumors

Earlier this week, researchers from several universities published a report exposing a string of security vulnerabilities in iOS and OS X. The vulnerabilities, all labeled as XARA weaknesses, let malicious apps approved on the Mac and iOS App Stores gain access to sensitive data like passwords.

The report details several methods that inter-app interaction services can use to access everything from the Keychain and Websocket on OS X to the URL scheme on iOS and OS X, giving hackers access to sensitive data, including information stored within third-party apps like 1Password, Gmail, Facebook, Twitter, Instagram, Evernote, and more.

Following the release of the report, iMore's Nick Arnott and Rene Ritchie have taken an in-depth look at the XARA weaknesses in a series of posts on the subject, explaining exactly what they do, how they work on iOS and OS X, and the steps that you can take to protect yourself.

The first post from iMore gives a quick overview of what XARA is, explaining that it's a group of exploits that use malicious apps to gain access to secure information by inserting themselves into the middle of a communications chain or sandbox.

OS X, not iOS, is primarily affected by XARA exploits, and the malicious apps are able to be distributed through the Mac App Store and the iOS Store. After being downloaded, an app using XARA exploits waits to intercept data. Ritchie explains how it works:

For OS X Keychains, it includes pre-registering or deleting and re-registering items. For WebSockets, it includes preemptively claiming a port. For Bundle IDs, it includes getting malicious sub-targets added to the access control lists (ACL) of legitimate apps.

For iOS, it includes hijacking the URL scheme of a legitimate app.

iMore's second in-depth XARA post, written by Nick Arnott, goes into even more detail on the XARA weaknesses and details how to determine if you've been affected. On OS X, checking for malicious keychain entries is possible by opening the Keychain Access app, clicking on an item in the list, choosing "Get Info" and looking at the "Access Control" tab to see which apps have access to the Keychain item.

As detailed by Arnott, the only XARA exploit that affects iOS devices is the one that involves URL scheme hijacking, detectable by paying careful attention to apps that open via URL scheme, as they may look slightly different than the real thing.

All that said, you can help protect yourself from URL scheme hijacking if you're paying attention: When URL schemes are called, the responding application gets called to the foreground. This means that even if a malicious app intercepts the URL scheme intended for another app, it will have to come to the foreground to respond. As such, an attacker will have to do a bit of work to pull of this sort of attack without being noticed by the user.

In one of the videos provided by the researchers, their malicious app attempts to impersonate Facebook. Similar to a phishing website that doesn't look quite like the real thing, the interface presented in the video as Facebook may give some users pause: The app presented isn't logged in to Facebook, and its UI is that of a web view, not the native app.

Apple's known about XARA for several months, and according to the researchers who shared the vulnerability with Apple, the company does appear to have tried to fix it several times without success. Avoiding the exploit is relatively simple, as Ritchie and Arnott point out. Avoiding malicious apps can be done by downloading software only from trusted developers and avoiding anything that seems suspicious.

For those interested in learning more about the XARA weaknesses, iMore's overview post on the exploit and the site's more in-depth post are well worth a read.

Update: Apple on Friday provided iMore with the following statement regarding the XARA exploits:

Earlier this week we implemented a server-side app security update that secures app data and blocks apps with sandbox configuration issues from the Mac App Store," an Apple spokesperson told iMore. "We have additional fixes in progress and are working with the researchers to investigate the claims in their paper."

Apple is planning a second-generation Apple Watch with new features including a front-facing FaceTime video camera, expanded Wi-Fi capabilities and possibly additional models based on new materials, according to 9to5Mac. The report claims the so-called "Apple Watch 2" is likely to be introduced in 2016 following the release of WatchOS 2 and native Apple Watch apps in the fall.

The new FaceTime camera will reportedly be built into the Apple Watch's top bezel and enable users to make and receive FaceTime calls on their wrists. Apple previously announced at WWDC that WatchOS 2 will have a new FaceTime Audio feature for Wi-Fi-based calling, and the new software also enables Apple Watch users to answer or reject FaceTime video calls through a paired iPhone.

A new Wi-Fi chip inside the Apple Watch 2 will expand the wrist-worn device's iPhone-free Wi-Fi capabilities for basic tasks, possibly including text messaging, emailing and up-to-date weather data. The new wireless chipset will also enable Find my Watch for tracking a lost, stolen or misplaced Apple Watch using Wi-Fi router triangulation technology as opposed to GPS.

Despite gaining several new features, the Apple Watch 2 will likely have similar battery life as the original model. The report claims that Apple has conducted market research and determined that, despite early concerns, most customers are satisfied with their Apple Watch's battery life, allowing Apple engineers to focus their efforts on other areas besides battery improvements.

Apple is also said to be exploring different Apple Watch variations beyond the Sport, Watch and Edition models currently available, in an effort to attract customers at price points between $1,000 and $10,000. The report claims it is possible, but not certain, that Apple may release new Apple Watch models based on metals such as titanium, tungsten, palladium or platinum.

Re/code has shared the full video and transcript of Apple senior vice president of operations Jeff Williams speaking with journalist Walt Mossberg at Code Conference in Ranchos Palos Verdes last month. Williams reflected on a number of topics during the half-hour session, ranging from the Apple Watch and wearable technology to running Apple's supply chain and overseeing the development of ResearchKit.

Williams also fielded questions from the audience about the changing need for physical storage and processing power on an iPhone, health-related monitoring systems on the Apple Watch, entering new product categories such as the car, vertical integration within Apple and the company's responsibility to advancing technologies and bringing jobs to the United States as a U.S. corporation.

Williams confirmed at the time that native Apple Watch apps will be available this fall through the WatchOS 2 SDK, providing developers with access to the wrist-worn device's Taptic Engine, Digital Crown, accelerometer, heart rate sensor, speaker and microphone. He also said Apple Watch sales are "fantastic," but neglected to provide any specific sales figures beyond saying "demand divided by supply is greater than one."

The latest data from Slice Intelligence, a digital commerce research firm that tracks email receipts, estimates Apple Watch sales at 2.79 million in the United States nearly two months after the wrist-worn device launched, according to Reuters. Slice Intelligence previously estimated 1 million Apple Watch pre-orders on April 10 and 2.5 million orders processed through late May.

The report claims that about 17 percent of those Apple Watch customers proceed to spend hundreds of dollars on extra bands for the smartwatch, enabling Apple to make a profitable double dip into customers' wallets. While the Sports Band starts at $49, for example, technology research firm IHS estimates the 38mm fluoroelastomer band costs Apple just $2.05 to make.

The estimate does not include the cost of packaging and shipping, and the bill of materials may in fact be slightly more expensive, but it remains clear that Apple has a significant profit margin on spare bands. Apple also sells the Classic Buckle, Milanese Loop and Leather Loop retail for $149, Modern Buckle for $249 and Link Bracelet for $449 through the Apple Online Store.

"It's just a psychological thing," said Carolina Milanesi, chief of research and head of U.S. business at Kantar Worldpanel ComTech, a consumer research firm. "I start with the least investment, and then I spend more money, but I get something else."

Apple Watch in-store reservations at Apple Stores began earlier this week ahead of the wrist-worn device's second wave launch in Italy, Mexico, Singapore, South Korea, Spain, Switzerland and Taiwan on June 26. A limited selection of Apple Watch models will be available at 10 Corso Como in Milan, BOONTHESHOP Cheongdam in Seoul and Malmaison by The Hour Glass in Singapore.

With less than two weeks until the launch of Apple Music in over 100 countries, the latest signs of the streaming music service continue to appear in iOS 8.4 and iOS 9 betas. A number of users running the pre-release software versions have shared screenshots showing a new Radio tab in the Music app that displays a Beats 1 demo alongside a list of other stations and genres.

The new Radio tab and Beats 1 pre-recording by DJ Zane Lowe have gone live for users in the United States, Canada, Germany, Norway, United Kingdom and select other countries, although it remains unclear if all features of Apple Music will be available worldwide on June 30. The search feature in the Radio tab is working as of now for some users, but Beats 1 and other playlists cannot be listened to yet.

The curated playlists shown in the screenshots cover a wide selection of genres, including classic, indie, pop-hits, all-city, francophone hits and charting music. Searching for and tapping on an individual song brings you to the Apple Music subscription menu that began appearing earlier this month and has revealed possible international pricing of €9.99/£9.99 per month in Europe and as low as $2-$3 per month in some countries.

Apple Music was announced last week as an all-in-one streaming music service, live global radio station and social platform for artists to connect with fans. The subscription-based service will be available June 30 for $9.99 per month after a three-month free trial period for iPhone, iPad, iPod touch, Mac and PC. Apple TV and Android versions of the service will be available in the fall.

Apple recently sent a mass email to news publishers to introduce them to Apple News, an upcoming Flipboard-inspired app for iOS 9 that will deliver curated news and magazine stories with custom layouts, photo galleries, videos and animations optimized for iPhone, iPad and iPod touch.

The email has ignited some controversy in the news and blogging community over the past week, according to the BBC, which reports that some writers are disappointed about Apple's decision to automatically include a website's RSS feeds in Apple News unless they specifically opt out by replying to the email.

"Let me get this straight, Apple: you send me an e-mail outlining the terms under which you will redistribute my content, and you will just assume that I agree to your terms unless I opt out?" wrote Plausible Labs programmer Mike Ash on his personal blog. "This makes typical clickwrap EULA nonsense look downright reasonable by comparison. You're going to consider me bound to terms you just declared to me in an e-mail as long as I don't respond? That's completely crazy. You don't even know if I received the e-mail!"

Some bloggers argue that not all publishers are guaranteed to see the email, which could easily be overlooked or buried in a spam inbox, leading to their content being featured on Apple News without their knowledge or explicit consent. Apple also has permission to place advertising next to or near a publisher's content without providing any compensation, and will pass on any legal fees to publishers.

You agree to let us use, display, store, and reproduce the content in your RSS feeds including placing advertising next to or near your content without compensation to you. Don’t worry, we will not put advertising inside your content without your permission.

You confirm that you have all necessary rights to publish your RSS content, and allow Apple to use it for News as we set forth here. You will be responsible for any payments that might be due to any contributors or other third parties for the creation and use of your RSS content.

If we receive a legal claim about your RSS content, we will tell you so that you can resolve the issue, including indemnifying Apple if Apple is included in the claim.

You can remove your RSS feed whenever you want by opting out or changing your settings in News Publisher.

Apple News is highlighted as one of the main features on the iOS 9 preview page, so it is no surprise that Apple is attempting to have as much content available on the platform at launch as possible. It is clear, however, that many publishers would have appreciated the terms of Apple News being set on an opt-in rather than opt-out basis. Apple so far has not commented on those concerns.

The United States Federal Communications Commission today announced plans to fine AT&T $100 million for misleading customers about its unlimited mobile data plans. Following an investigation, the FCC is accusing AT&T of severely slowing down the data speeds of customers with unlimited data plans and failing to adequately warn them about the slower data speeds.

In 2011, AT&T implemented a "Maximum Bit Rate" policy and capped the maximum data speeds for unlimited customers after they used a set amount of data within a billing cycle. The capped speeds were much slower than the normal network speeds AT&T advertised and significantly impaired the ability of AT&T customers to access the Internet or use data applications for the remainder of the billing cycle.

The FCC says AT&T violated the 2010 Open Internet Transparency Rule by falsely calling its plans "unlimited" and by not informing customers of the maximum speed they would receive under AT&T's Maximum Bit Rate policy. Millions of customers suffered slow data speeds, with some seeing speed reductions for 12 days per month on average.

On the decision, FCC chairman Tom Wheeler had this to say: "Customers deserve to get what they pay for. Broadband providers must be upfront and transparent about the services they provide. The FCC will not stand idly by while consumers are deceived by misleading marketing materials and insufficient disclosure."

AT&T ceased offering unlimited data plans years ago, but it continues to have customers with grandfathered unlimited data plans. AT&T previously throttled all of those customers after they exceeded 5GB of LTE data, but in May, AT&T implemented a policy change that sees customers being throttled only when connected to a cell tower experiencing network congestion.

Along with facing a $100 million fine levied by the FCC, AT&T is also involved in an ongoing lawsuit with the Federal Trade Commission over the same issue.

KGI Securities analyst Ming-Chi Kuo has issued a note to investors, a copy of which was obtained by Japanese blog Mac Otakara, in which he corroborates rumors that the next-generation iPhone will adopt 7000 Series aluminum as used in the Apple Watch Sport. Kuo also claimed that Apple will retain the same design as the iPhone 6, although the smartphone may have slightly different dimensions.

The report claims that the next-generation iPhone could be wider and taller by about 0.15mm to account for the stronger 7000 Series aluminum design, while the smartphone may also be about 0.2mm thicker due to the addition of Force Touch. The new dimensions are marginal enough that most iPhone 6 users are unlikely to notice much of a difference with the so-called "iPhone 6s" design.

Apple explains the properties of 7000 Series aluminum on its Apple Watch website:

"For Apple Watch Sport, we started with 7000 Series aluminum — the same used in competition bicycles. We altered it to create a new alloy that’s just as light, yet even more durable — it’s 60 percent stronger than most aluminum, and one-third the density of stainless steel. It has a bright, lustrous colour and a uniform structure free of defects and impurities. Each case is machined and polished, then blasted with microscopic zirconia beads to achieve a consistent, satin texture. A special anodizing process creates a hard, clear outer layer that helps protect against scratches and corrosion."

Kuo reiterated that the next-generation iPhone will be available in a new Rose Gold color option, similar to the rose gold Apple Watch Edition, and also claimed that the existing gold color could be changed to look more like the yellow gold Apple Watch Edition. The existing space gray iPhone is also expected to look slightly more black, possibly in line with the space black Apple Watch.

Last month, Kuo shared a long list of predictions for the next-generation iPhone, including an A9 processor with 2GB of RAM, Force Touch, an improved 12-megapixel rear-facing camera, new Rose Gold color option, improved Touch ID recognition, gesture control support and more. Apple will likely retain 4.7-inch and 5.5-inch screen sizes akin to the iPhone 6 and iPhone 6 Plus.

Apple's fleet of vehicles collecting street-level mapping data has arrived in the United Kingdom as planned, with the first verified sighting in Solihull, England, approximately two hours northwest of London. While camera-equipped fifth-generation Dodge Caravans have been used to collect mapping data in the United States, Apple appears to be using Mercedes-Benz Vito vans marked with "Apple Maps" in Europe.

Apple confirmed earlier this month that it is driving vehicles around the world to collect data to improve Apple Maps, and the mapping imagery is almost certainly being used to create a Google Maps "Street View" competitor. Apple Maps vehicles are also taking photos of businesses and storefronts in major metropolitan areas to replace current imagery provided by third-party sources such as Yelp.

The cities and regions where Apple Maps vehicles will be driving in England through July:

East of England
Essex (Brentwood, Epping Forest), Hertfordshire (Broxbourne, Dacorum, Hertsmere, St Albans, Three Rivers, Watford, Welwyn Hatfield)

Greater London
Barking and Dagenham, Barnet, Bexley, Brent, Bromley, Camden, City of London, City of Westminster, Croydon, Ealing, Enfield, Greenwich, Hackney, Hammersmith and Fulham, Haringey, Harrow, Havering, Hillingdon, Hounslow, Islington, Kensington and Chelsea, Kingston upon Thames, Lambeth, Lewisham, Merton, Newham, Redbridge, Richmond upon Thames, Southwark, Sutton, Tower Hamlets, Waltham Forest, Wandsworth

South East
Kent (Dartford, Sevenoaks), Surrey (Elmbridge, Epsom and Ewell, Spelthorne)

West Midlands
Birmingham (Sutton Coldfield, Perry Barr, Erdington, Ladywood, Hodge Hill, Yardley, Edgbaston, Hall Green, Selly Oak, Northfield), Dudley, Sandwell, Solihull, Staffordshire, Walsall, Warwickshire, Worcestershire

Apple has also updated its Apple Maps vehicles website with a new list of locations where it will be collecting data between July 1 to July 14, with notable additions including New Orleans and unmapped areas in Santa Clara County. Apple may also be at least temporarily finished collecting data in multiple states it has canvassed over the past several months, including Arizona, Florida, Georgia and Hawaii.

(Thanks, Stephen!)

A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.

The thirteen-page research paper "Unauthorized Cross-App Resource Access on Mac OS X and iOS" details that inter-app interaction services, ranging from the Keychain and WebSocket on OS X to the URL Scheme on OS X and iOS, can be exploited to steal confidential information and passwords, including those stored in popular password vaults such as 1Password by AgileBits.

"We completely cracked the keychain service - used to store passwords and other credentials for different Apple apps - and sandbox containers on OS X, and also identified new weaknesses within the inter-app communication mechanisms on OS X and iOS which can be used to steal confidential data from Evernote, Facebook and other high-profile apps."

The different cross-app and communication mechanism vulnerabilities discovered on iOS and OS X, identified as XARA weaknesses, include Keychain password stealing, IPC interception, scheme hijacking and container cracking. The affected apps and services include iCloud, Gmail, Google Drive, Facebook, Twitter, Chrome, 1Password, Evernote, Pushbullet, Dropbox, Instagram, WhatsApp, Pinterest, Dashlane, AnyDo, Pocket and several others.

Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker's request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.